Obfuscation of Abstract Data-Types - Rowan
Obfuscation of Abstract Data-Types - Rowan
Obfuscation of Abstract Data-Types - Rowan
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
CHAPTER 2. OBFUSCATIONS FOR INTERMEDIATE LANGUAGE 28<br />
new instructions. This replacement is an example <strong>of</strong> a rewrite rule [32]:<br />
L ⇒ R if c<br />
which says that if the condition c is true then we replace each occurrence <strong>of</strong><br />
L with R. This form <strong>of</strong> rewrite rule can be automated and we summarise the<br />
transformation toolkit described in [22] to demonstrate one way <strong>of</strong> specifying<br />
obfuscations for IL. This toolkit consists <strong>of</strong> three main components:<br />
• A representation <strong>of</strong> IL, called EIL, which makes specifying transformations<br />
easier.<br />
• A new specification language, called Path Logic Programming, which allows<br />
us to specify program transformations on the control flow graph.<br />
• A strategy language with which we can control how the transformations<br />
are applied.<br />
We briefly describe these components (more details can be found in [22]) before<br />
specifying some <strong>of</strong> the generalised obfuscations given in Section 1.3.<br />
2.3.1 Path Logic Programming<br />
Path Logic Programming (PLP) is a new language developed for the specification<br />
<strong>of</strong> program transformations. PLP extends Prolog [51] with new primitives<br />
to help express the side conditions <strong>of</strong> transformations. The Prolog program will<br />
be interpreted relative to the flow graph <strong>of</strong> the object program that is being<br />
transformed. One new primitive is<br />
all Q (N ,M)<br />
which is true if N and M are nodes in the flow graph, and all paths from N to<br />
M are <strong>of</strong> the form specified by the pattern Q. Furthermore, there should be at<br />
least one path that satisfies the pattern Q. This is to stop a situation where we<br />
do not have a path between N and M and so the predicate all Q (N ,M) will<br />
be vacuously true. Similarly, the predicate<br />
exists Q (N ,M)<br />
is true if there exists a path from N to M which satisfies the pattern Q.<br />
As an example <strong>of</strong> all, consider:<br />
all ( { }∗;<br />
{ ′ set(X,A),<br />
local(X)};<br />
{ not ( ′ def (X)) }∗;<br />
{ ′ use(X)}<br />
) (entry,N)<br />
This definition says that all paths from the program entry to node N should<br />
satisfy a particular pattern. A path is a sequence <strong>of</strong> edges in the flow graph.<br />
The pattern for a path is a regular expression and in the above example the<br />
regular expression consists <strong>of</strong> four components: